Executive brief
JetBrains YouTrack is a project and issue tracking platform used by development teams to manage work and collaboration. A flaw in role assignment validation allows attackers to escalate their privileges within YouTrack, potentially gaining unauthorized access to sensitive project data, configurations, and administrative functions.
Technical details
The vulnerability exists in YouTrack's role assignment mechanism, where insufficient validation of role assignments allows privilege escalation. An attacker with limited access can exploit this flaw to assign themselves elevated roles or permissions without proper authorization checks. The attack requires network access to the YouTrack instance and may require some level of existing authentication. Successful exploitation allows an attacker to gain administrative or higher-privileged access. The issue is resolved in YouTrack version 2026.2.18634 and later.
Affected products
- JetBrains YouTrack before 2026.2.18634
Timeline
- 2026-09-07: disclosed